SlideShare uma empresa Scribd logo
1 de 59
Staying out of harm's way
Full Web Stack Security
[object Object],[object Object],[object Object],GVS   ( Drupal   Security Review)
Prelude
OWASP TOP  10 the 10 most  worissome   web app  attack  vectors (owasp.org)
I. on the  app A1.  Injection A2. Cross-Site Scripting ( XSS ) A3. Broken Authentication and  Session  Management A4.  Insecure  Direct Object References A5. Cross-Site Request Forgery ( CSRF )
II. also  off  the  app ,[object Object],[object Object],[object Object],[object Object],[object Object]
  ,[object Object],[object Object]
[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
  ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
[object Object],[object Object]
  ,[object Object]
  ,[object Object],[object Object]
well...  not  really
it's a  dirty  fight
Dark mood
but there's  hope ...
Sonata
  ,[object Object]
permitted  HTTP  methods ,[object Object],[object Object],[object Object]
  ,[object Object]
WebDAV   ,[object Object],[object Object]
  ,[object Object]
  ,[object Object],[object Object],[object Object]
  ,[object Object]
  ,[object Object],[object Object],[object Object],[object Object]
  ,[object Object]
  ,[object Object],[object Object]
  ,[object Object],[object Object]
 
  ,[object Object]
  ,[object Object],[object Object]
  ,[object Object],[object Object]
 
  ,[object Object],[object Object]
  ,[object Object],[object Object],[object Object]
Black Ops laying low
hunting  like a black panther in the  night
Aria
  ,[object Object]
  ,[object Object],[object Object],[object Object],[object Object]
  ,[object Object],[object Object],[object Object]
  ,[object Object],[object Object],[object Object],[object Object],[object Object]
  ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
  ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
  ,[object Object],[object Object],[object Object],[object Object],[object Object]
  ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
  ,[object Object],[object Object],[object Object],[object Object]
The match fâites vos jeux
the   rules  of the Marquis of Queensbury apply  to this  match
Chaconne
  ,[object Object],[object Object],[object Object],[object Object],[object Object]
 
Minuetto
There's so  much  stuff we  had  to left out
these for example ,[object Object],[object Object],[object Object],[object Object]
to be continued... somewhere  over the rainbow
  ,[object Object],[object Object],[object Object],[object Object],[object Object]
  ,[object Object],[object Object],[object Object]

Mais conteúdo relacionado

Mais procurados

Realtime Communication Techniques with PHP
Realtime Communication Techniques with PHPRealtime Communication Techniques with PHP
Realtime Communication Techniques with PHP
WaterSpout
 
Hacking Robotics(English Version)
Hacking Robotics(English Version)Hacking Robotics(English Version)
Hacking Robotics(English Version)
Kensei Demura
 

Mais procurados (20)

Tools used for debugging
Tools used for debuggingTools used for debugging
Tools used for debugging
 
SFScon 2020 - Jakob Schwienbacher - Linux as HA Router - Linux Kernel keepali...
SFScon 2020 - Jakob Schwienbacher - Linux as HA Router - Linux Kernel keepali...SFScon 2020 - Jakob Schwienbacher - Linux as HA Router - Linux Kernel keepali...
SFScon 2020 - Jakob Schwienbacher - Linux as HA Router - Linux Kernel keepali...
 
Алексей Петров "Dockerize Me: Distributed PHP applications with Symfony, Dock...
Алексей Петров "Dockerize Me: Distributed PHP applications with Symfony, Dock...Алексей Петров "Dockerize Me: Distributed PHP applications with Symfony, Dock...
Алексей Петров "Dockerize Me: Distributed PHP applications with Symfony, Dock...
 
PHP Project development with Vagrant
PHP Project development with VagrantPHP Project development with Vagrant
PHP Project development with Vagrant
 
Backing up thousands of containers
Backing up thousands of containersBacking up thousands of containers
Backing up thousands of containers
 
A little systemtap
A little systemtapA little systemtap
A little systemtap
 
Squid server
Squid serverSquid server
Squid server
 
Realtime Communication Techniques with PHP
Realtime Communication Techniques with PHPRealtime Communication Techniques with PHP
Realtime Communication Techniques with PHP
 
Lessons from running potentially malicious code inside containers
Lessons from running potentially malicious code inside containersLessons from running potentially malicious code inside containers
Lessons from running potentially malicious code inside containers
 
Three Years of Lessons Running Potentially Malicious Code Inside Containers
Three Years of Lessons Running Potentially Malicious Code Inside ContainersThree Years of Lessons Running Potentially Malicious Code Inside Containers
Three Years of Lessons Running Potentially Malicious Code Inside Containers
 
Dockerize Me: Distributed PHP applications with Symfony, Docker, Consul and A...
Dockerize Me: Distributed PHP applications with Symfony, Docker, Consul and A...Dockerize Me: Distributed PHP applications with Symfony, Docker, Consul and A...
Dockerize Me: Distributed PHP applications with Symfony, Docker, Consul and A...
 
Hacking Robotics(English Version)
Hacking Robotics(English Version)Hacking Robotics(English Version)
Hacking Robotics(English Version)
 
Wordpress y Docker, de desarrollo a produccion
Wordpress y Docker, de desarrollo a produccionWordpress y Docker, de desarrollo a produccion
Wordpress y Docker, de desarrollo a produccion
 
Root via XSS
Root via XSSRoot via XSS
Root via XSS
 
Hiding in plain sight
Hiding in plain sightHiding in plain sight
Hiding in plain sight
 
A little waf
A little wafA little waf
A little waf
 
Testing Wi-Fi with OSS Tools
Testing Wi-Fi with OSS ToolsTesting Wi-Fi with OSS Tools
Testing Wi-Fi with OSS Tools
 
Rihards Olups - Encrypting Daemon Traffic With Zabbix 3.0
Rihards Olups - Encrypting Daemon Traffic With Zabbix 3.0Rihards Olups - Encrypting Daemon Traffic With Zabbix 3.0
Rihards Olups - Encrypting Daemon Traffic With Zabbix 3.0
 
Squid
SquidSquid
Squid
 
DNS High-Availability Tools - Open-Source Load Balancing Solutions
DNS High-Availability Tools - Open-Source Load Balancing SolutionsDNS High-Availability Tools - Open-Source Load Balancing Solutions
DNS High-Availability Tools - Open-Source Load Balancing Solutions
 

Semelhante a Full Web Stack Security

us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...
us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...
us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...
sonjeku1
 
All about routers
All about routersAll about routers
All about routers
agwanna
 
Simplest-Ownage-Human-Observed… - Routers
 Simplest-Ownage-Human-Observed… - Routers Simplest-Ownage-Human-Observed… - Routers
Simplest-Ownage-Human-Observed… - Routers
Logicaltrust pl
 
Filip palian mateuszkocielski. simplest ownage human observed… routers
Filip palian mateuszkocielski. simplest ownage human observed… routersFilip palian mateuszkocielski. simplest ownage human observed… routers
Filip palian mateuszkocielski. simplest ownage human observed… routers
Yury Chemerkin
 
Wifi Security, or Descending into Depression and Drink
Wifi Security, or Descending into Depression and DrinkWifi Security, or Descending into Depression and Drink
Wifi Security, or Descending into Depression and Drink
SecurityTube.Net
 
Python Deployment with Fabric
Python Deployment with FabricPython Deployment with Fabric
Python Deployment with Fabric
andymccurdy
 

Semelhante a Full Web Stack Security (20)

us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...
us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...
us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-La...
 
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! ...
 
All about routers
All about routersAll about routers
All about routers
 
Simplest-Ownage-Human-Observed… - Routers
 Simplest-Ownage-Human-Observed… - Routers Simplest-Ownage-Human-Observed… - Routers
Simplest-Ownage-Human-Observed… - Routers
 
Filip palian mateuszkocielski. simplest ownage human observed… routers
Filip palian mateuszkocielski. simplest ownage human observed… routersFilip palian mateuszkocielski. simplest ownage human observed… routers
Filip palian mateuszkocielski. simplest ownage human observed… routers
 
Parrot Drones Hijacking
Parrot Drones HijackingParrot Drones Hijacking
Parrot Drones Hijacking
 
Null bhopal Sep 2016: What it Takes to Secure a Web Application
Null bhopal Sep 2016: What it Takes to Secure a Web ApplicationNull bhopal Sep 2016: What it Takes to Secure a Web Application
Null bhopal Sep 2016: What it Takes to Secure a Web Application
 
Wifi Security, or Descending into Depression and Drink
Wifi Security, or Descending into Depression and DrinkWifi Security, or Descending into Depression and Drink
Wifi Security, or Descending into Depression and Drink
 
Python Deployment with Fabric
Python Deployment with FabricPython Deployment with Fabric
Python Deployment with Fabric
 
SSRF For Bug Bounties
SSRF For Bug BountiesSSRF For Bug Bounties
SSRF For Bug Bounties
 
IBCAST 2021: Observations and lessons learned from the APNIC Community Honeyn...
IBCAST 2021: Observations and lessons learned from the APNIC Community Honeyn...IBCAST 2021: Observations and lessons learned from the APNIC Community Honeyn...
IBCAST 2021: Observations and lessons learned from the APNIC Community Honeyn...
 
Using aphace-as-proxy-server
Using aphace-as-proxy-serverUsing aphace-as-proxy-server
Using aphace-as-proxy-server
 
Linux Networking Explained
Linux Networking ExplainedLinux Networking Explained
Linux Networking Explained
 
Future Internet Week - IPv6 the way forward: IPv6 and security from a user’s ...
Future Internet Week - IPv6 the way forward: IPv6 and security from a user’s ...Future Internet Week - IPv6 the way forward: IPv6 and security from a user’s ...
Future Internet Week - IPv6 the way forward: IPv6 and security from a user’s ...
 
Infrastructureascode slideshare-160331143725
Infrastructureascode slideshare-160331143725Infrastructureascode slideshare-160331143725
Infrastructureascode slideshare-160331143725
 
Infrastructureascode slideshare-160331143725
Infrastructureascode slideshare-160331143725Infrastructureascode slideshare-160331143725
Infrastructureascode slideshare-160331143725
 
Infrastructure as code: running microservices on AWS using Docker, Terraform,...
Infrastructure as code: running microservices on AWS using Docker, Terraform,...Infrastructure as code: running microservices on AWS using Docker, Terraform,...
Infrastructure as code: running microservices on AWS using Docker, Terraform,...
 
Securing Your Web Server
Securing Your Web ServerSecuring Your Web Server
Securing Your Web Server
 
MNPHP Scalable Architecture 101 - Feb 3 2011
MNPHP Scalable Architecture 101 - Feb 3 2011MNPHP Scalable Architecture 101 - Feb 3 2011
MNPHP Scalable Architecture 101 - Feb 3 2011
 
DevOps in PHP environment
DevOps in PHP environment DevOps in PHP environment
DevOps in PHP environment
 

Mais de Drupal Portugal

Mais de Drupal Portugal (18)

DRUPAL DIGITAL MARKETING CHECKLIST
DRUPAL DIGITAL MARKETING CHECKLISTDRUPAL DIGITAL MARKETING CHECKLIST
DRUPAL DIGITAL MARKETING CHECKLIST
 
Drupal Day Portugal 2020 - Closing Remarks / Encerramento
Drupal Day Portugal 2020 - Closing Remarks / EncerramentoDrupal Day Portugal 2020 - Closing Remarks / Encerramento
Drupal Day Portugal 2020 - Closing Remarks / Encerramento
 
BRANCHING MODELS (workshop)
BRANCHING MODELS (workshop)BRANCHING MODELS (workshop)
BRANCHING MODELS (workshop)
 
TURN YOUR DRUPAL INTO A DIGITAL EXPERIENCE PLATFORM (DXP)
TURN YOUR DRUPAL INTO A DIGITAL EXPERIENCE PLATFORM (DXP)TURN YOUR DRUPAL INTO A DIGITAL EXPERIENCE PLATFORM (DXP)
TURN YOUR DRUPAL INTO A DIGITAL EXPERIENCE PLATFORM (DXP)
 
DRUPAL CACHE SYSTEMS AND VARNISH
DRUPAL CACHE SYSTEMS AND VARNISHDRUPAL CACHE SYSTEMS AND VARNISH
DRUPAL CACHE SYSTEMS AND VARNISH
 
COMO CRIAR O TEU STARTUP PROJECT E SETUP DO TEU AMBIENTE DE DESENVOLVIMENTO D...
COMO CRIAR O TEU STARTUP PROJECT E SETUP DO TEU AMBIENTE DE DESENVOLVIMENTO D...COMO CRIAR O TEU STARTUP PROJECT E SETUP DO TEU AMBIENTE DE DESENVOLVIMENTO D...
COMO CRIAR O TEU STARTUP PROJECT E SETUP DO TEU AMBIENTE DE DESENVOLVIMENTO D...
 
Drupal Day Portugal 2020
Drupal Day Portugal 2020Drupal Day Portugal 2020
Drupal Day Portugal 2020
 
Panels: Drupal Cubista
Panels: Drupal CubistaPanels: Drupal Cubista
Panels: Drupal Cubista
 
Como Colaborar na Tradução
Como Colaborar na Tradução Como Colaborar na Tradução
Como Colaborar na Tradução
 
Também há Drupal em Portugal
Também há Drupal em PortugalTambém há Drupal em Portugal
Também há Drupal em Portugal
 
Rules e Drupal
Rules e DrupalRules e Drupal
Rules e Drupal
 
Temas em Drupal
Temas em DrupalTemas em Drupal
Temas em Drupal
 
Drupal e o seu ecossistema
Drupal e o seu ecossistemaDrupal e o seu ecossistema
Drupal e o seu ecossistema
 
Drupal mapping, a brid's eye view
Drupal mapping, a brid's eye viewDrupal mapping, a brid's eye view
Drupal mapping, a brid's eye view
 
Drupal 7
Drupal 7Drupal 7
Drupal 7
 
Business of Drupal
Business of DrupalBusiness of Drupal
Business of Drupal
 
DrupalCamp Lisboa 2011
DrupalCamp Lisboa 2011DrupalCamp Lisboa 2011
DrupalCamp Lisboa 2011
 
Business Angels e oportunidades de negócio
Business Angels e oportunidades de negócioBusiness Angels e oportunidades de negócio
Business Angels e oportunidades de negócio
 

Último

Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 

Último (20)

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 

Full Web Stack Security

Notas do Editor

  1. Falar do de Night of the Hunter (1955) a batalha das mãos entre o amor e o ódio. Gostamos da web. Mas há muitos perigos à espreita. A web é cada vez mais um vector de ataque. Com o movimento para a cloud isso agudiza-se. Quem hoje não encara a segurança como uma questão estratégica tão vital quanto a conectividade para o negócio não estão em acordo com a dura realidade que existe aqui.
  2. Iniciar
  3. isto aqui foi reduzi